Overview

overview

10

Static

static

10

01/2015.5.27/01.vir

windows7_x64

3

01/2015.5.27/01.vir

windows10_x64

3

PER-DCOMP-...ao.dll

windows7_x64

1

PER-DCOMP-...ao.dll

windows10_x64

1

01/2015.5.27/03.exe

windows7_x64

8

01/2015.5.27/03.exe

windows10_x64

8

01/2015.5.27/04.exe

windows7_x64

1

01/2015.5.27/04.exe

windows10_x64

1

01/2015.5.27/05.exe

windows7_x64

10

01/2015.5.27/05.exe

windows10_x64

10

01/2015.5.27/07.exe

windows7_x64

7

01/2015.5.27/07.exe

windows10_x64

7

01/2015.5.27/09.exe

windows7_x64

10

01/2015.5.27/09.exe

windows10_x64

10

01/2015.5.27/10.exe

windows7_x64

10

01/2015.5.27/10.exe

windows10_x64

10

01/2015.5.27/12.pdf

windows7_x64

1

01/2015.5.27/12.pdf

windows10_x64

1

01/2015.5.27/13.pdf

windows7_x64

1

01/2015.5.27/13.pdf

windows10_x64

1

01/2015.5.27/14.exe

windows7_x64

8

01/2015.5.27/14.exe

windows10_x64

8

01/2015.5.27/15.dll

windows7_x64

1

01/2015.5.27/15.dll

windows10_x64

1

01/2015.5.27/16.rtf

windows7_x64

10

01/2015.5.27/16.rtf

windows10_x64

1

01/2015.5.27/17.pdf

windows7_x64

1

01/2015.5.27/17.pdf

windows10_x64

1

01/2015.5.27/18.doc

windows7_x64

1

01/2015.5.27/18.doc

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca

  • Size

    3.3MB

  • MD5

    be6098d5806e306c115c4ecae0e79049

  • SHA1

    46a5b8c8132a8f619ab7fcd5494091c727d9d0f1

  • SHA256

    9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca

  • SHA512

    6d9bb5390c66c58cba7f63000bc0d26d52fa28121c23f6da5f0bb3a3e16d4b868ef09a917a3a7ffc01c57cac768b73e1874e166b18316952ab5f5d7d99700a9c

  • SSDEEP

    98304:5M7M5FcZFFlrTBu5lAy/hDNTLqdrLLo9qF:i7M5uZ945lzTfgLLo90

Score
10/10
pdflinkhackedmacromacro_on_actionnjrat

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

supernovaswag.ignorelist.com:5552

sooosoo45.publicvm.com:1111
Mutex

d0f93c61091a2240aa3fd0d7912b4f59

Attributes
  • reg_key

    d0f93c61091a2240aa3fd0d7912b4f59

  • splitter

    |'|'|

Signatures

  • Njrat family
    njrat
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink

Files

  • 9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca
    .zip
  • 01/2015.5.27/01.vir
  • 01/2015.5.27/02.vir
    .zip
  • PER-DCOMP-Intimacao.cpl
    .dll windows x86


    Code Sign

    Headers

    Exports

    Sections

  • 01/2015.5.27/03.vir
    .exe windows x86

    53dbb427d4fc9e9527dfdd72661dae65


    Code Sign

    Headers

    Imports

    Sections

  • 01/2015.5.27/04.vir
    .exe windows x86


    Code Sign

    Headers

    Sections

  • 01/2015.5.27/05.vir
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 01/2015.5.27/06.vir
  • 01/2015.5.27/07.vir
    .exe windows x86

    419a575654b12fd46656186b46dd81f1


    Code Sign

    Headers

    Imports

    Sections

  • 01/2015.5.27/08.vir
  • 01/2015.5.27/09.vir
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 01/2015.5.27/10.vir
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 01/2015.5.27/11.vir
    .doc .vbs windows office2003
  • 01/2015.5.27/12.vir
    .pdf
  • 01/2015.5.27/13.vir
    .pdf

    • http://em-maq.com/B31zYtUwrmOj

  • 01/2015.5.27/14.vir
    .exe windows x86

    ffca4b8182ebb8822b4187a5e1e23e14


    Code Sign

    Headers

    Imports

    Sections

  • 01/2015.5.27/15.vir
    .dll windows x86

    82599808f5dc1667384df6e7891cf0b0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 01/2015.5.27/16.vir
    .rtf .vir
  • 01/2015.5.27/17.vir
    .pdf
  • 01/2015.5.27/18.vir
    .doc .vir windows office2003

    ThisDocument

    NewMacros